Replace Vite/React scaffold with Go build spec

- AGENTS.md: build spec for Paperclip (constraints, conventions, 7 phases)
- docs/phase-1..7: per-phase work, DoD, out-of-scope, risks
- reference/: frozen decisions, stack+ports+budgets, content map, acceptance tests
- agents/: persona and security policy drafts
- Retires the React scaffold; history retained as record of the false start

reference/stack.md

@@ -0,0 +1,61 @@
+# Stack, hosts, ports, budgets
+
+## Hosts (measured 2026-10-17)
+
+| Host | Name | Role | RAM total / free | Swap used | CPUs |
+|---|---|---|---|---|---|
+| `.13` | `nixos-desktop` | **Runtime** — app, Qdrant, Prefect worker | 15 GiB / **2.3 GiB** | **8.1 GiB** | 12 |
+| `.35` | `sam-Ubuntu1` | **Public edge** — Caddy terminates 443; also Gitea, Immich, Nextcloud, Penpot, Wiki.js | 14 GiB / 4.1 GiB | 4.0 GiB | 2 |
+| `.27` | `sam-4screen-desktop` | **Build / dev** — sources, Obsidian vault, agent work | — | — | — |
+
+`.13` is memory-bound, not CPU-bound. The budget is real: exceeding it destabilises services Sam relies on.
+
+## Ports
+
+| Service | Host | Port | State |
+|---|---|---|---|
+| Caddy | `.35` | 443 (+ LAN 8000) | existing — **Sam applies any change** |
+| **Go app** | `.13` | **8096** | new — verify free (`8095` = offsite.lab) |
+| Qdrant REST | `.13` | 6333 | new, `127.0.0.1` only |
+| Qdrant gRPC | `.13` | 6334 | new, `127.0.0.1` only |
+| Prefect server | `.13` | existing | reuse — do not deploy a second |
+| OmniRoute | `.13` | existing | reuse — the only model gateway |
+| Postgres | `.13` | 5432 | reuse if needed |
+| Whisper / Piper | `.13` | existing | reuse (Phase 7 voice only) |
+| LangGraph service | `.13` | 8096+1 or existing | Phase 5 — see note below |
+
+**Known occupied:** 3000, 3020, 5000, 5002, 5432, 8000, 8001, 8080, 8082, 8090, 8091, 8092, 8095, 8230, 8231, 8500, 8501, 8788–8792, 3081–3084, 1883.
+
+## Memory budget
+
+| Component | Cap |
+|---|---|
+| Go app | 120 m |
+| Qdrant | 400 m |
+| Prefect worker | 150 m |
+| Guardrail (if local) | 300 m |
+| **Total ceiling** | **1.0 GiB / 4 containers** |
+
+Every service sets `mem_limit` **and** `memswap_limit` to the same value so it cannot consume host swap. Bind to `127.0.0.1`; Caddy is the only public listener.
+
+## Paths
+
+| Item | Path |
+|---|---|
+| Repo working copy | `/home/sam/paseo/projects/resume_ai_system_paperclip_build` |
+| Release root | `/home/sam/deployment/resume/` |
+| Live symlink | `/home/sam/deployment/resume/current` |
+| Secrets | `~/.config/environment.d/10-secrets.conf` |
+| Planning reference | `/home/sam/paseo/projects/resume_ai_system/plan/` (read-only) |
+
+## Public entry
+
+`resume.lab.audasmedia.com.au` — wildcard DNS already resolves to the public edge on `.35`. **No DNS work is required.** Caddy block is specified in Phase 3 §3.3.
+
+## Open items
+
+| Item | Owner |
+|---|---|
+| Embedding provider (Gemini free tier vs OpenRouter vs local) | Sam — decide before Phase 4 |
+| Repo public/private after launch | Sam — decide after Phase 3 |
+| Phone number on the contact page | Sam |